Authenticate with a seeded operator key; fold escalation and switches into TerdutTeam

Credentials: the TerdutServer controller generates <name>-operator-key in
the server's own namespace (owned by it) and hands it to the pods as
TERDUT_OPERATOR_KEY; the server creates its instance-scoped account from it
at every start. A replaced Secret rolls the pods. The bootstrap handshake,
the checkpoint Secret, per-team service accounts and credentials Secrets,
BootstrapStateLost and credentials.deletionPolicy are gone.

CRDs: TerdutServer, TerdutTeam and TerdutAlertSource. TerdutEscalationRule
and TerdutDeadmanSwitch become spec.escalation and spec.deadmanSwitches[]
on the team (matched by name, extras removed); team invites are removed.
A team is created under the identity <namespace>/<name> (external_id), so a
retry, a lost status or a deleted team heal by repeating the same call, and
a display name owned by another team is TeamNameTaken instead of an
adoption. The server resolves escalation usernames (UnknownUser condition).
OIDC claim names and trustEmail are spec fields.

Fixes: query values are URL-escaped; every delete treats 404 as success;
deleting a team no longer depends on allowedTeams consent; a switch or
integration deleted on the server is recreated; unnamed switches take the
CR's name.

Cleanup: scaffold e2e test, AGENTS.md, devcontainer, unused config/ pieces
and Client.Version() removed; DESIGN.md, README, ROADMAP and the demo
(run-demo.sh, manifests) rewritten for the new design. Secret RBAC stays
cluster-wide, now stated in DESIGN.md section 9.

Claude-Session: https://claude.ai/code/session_016mBLURvJoMuUEr9cB2RpUN

internal/controller/terdutserver_deployment.go

@@ -3,6 +3,7 @@ package controller
 import (
 	"context"
 	"fmt"
+	"maps"
 	"strings"
 
 	appsv1 "k8s.io/api/apps/v1"
@@ -31,7 +32,7 @@ func labelsFor(srv *terdutv1alpha1.TerdutServer) map[string]string {
 // object (not just the desired one) so the caller can check
 // status.readyReplicas.
 func (r *TerdutServerReconciler) reconcileDeployment(
-	ctx context.Context, srv *terdutv1alpha1.TerdutServer, dbEnv []corev1.EnvVar,
+	ctx context.Context, srv *terdutv1alpha1.TerdutServer, dbEnv []corev1.EnvVar, keyHash string,
 ) (*appsv1.Deployment, error) {
 	deploy := &appsv1.Deployment{ObjectMeta: metav1.ObjectMeta{Name: srv.Name, Namespace: srv.Namespace}}
 	_, err := controllerutil.CreateOrUpdate(ctx, r.Client, deploy, func() error {
@@ -60,13 +61,8 @@ func (r *TerdutServerReconciler) reconcileDeployment(
 		deploy.Spec.Strategy = appsv1.DeploymentStrategy{Type: appsv1.RollingUpdateDeploymentStrategyType}
 		pod := srv.Spec.Pod
 		deploy.Spec.Template = corev1.PodTemplateSpec{
-			// pod.Annotations is assigned directly, not merged -- nothing
-			// else sets pod-template annotations today. If a future change
-			// needs the controller to set one of its own (e.g. a
-			// Prometheus-scrape annotation), this needs to become a real
-			// map merge with a stated precedence rather than silently
-			// clobbering one side.
-			ObjectMeta: metav1.ObjectMeta{Labels: labels, Annotations: pod.Annotations},
+			// The controller's own annotation wins over a same-named user one.
+			ObjectMeta: metav1.ObjectMeta{Labels: labels, Annotations: podAnnotations(pod.Annotations, keyHash)},
 			Spec: corev1.PodSpec{
 				EnableServiceLinks:        new(false),
 				NodeSelector:              pod.NodeSelector,
@@ -127,6 +123,17 @@ func (r *TerdutServerReconciler) reconcileService(ctx context.Context, srv *terd
 	return err
 }
 
+// operatorKeyHashAnnotation records which operator key the pods were started
+// with, so replacing the key's Secret rolls them.
+const operatorKeyHashAnnotation = "terdut.ryuvia.com/operator-key-hash"
+
+func podAnnotations(user map[string]string, keyHash string) map[string]string {
+	out := make(map[string]string, len(user)+1)
+	maps.Copy(out, user)
+	out[operatorKeyHashAnnotation] = keyHash
+	return out
+}
+
 func servicePort(srv *terdutv1alpha1.TerdutServer) int32 {
 	if srv.Spec.Networking.ServicePort == 0 {
 		return 8080
@@ -194,13 +201,6 @@ func buildEnv(srv *terdutv1alpha1.TerdutServer, dbEnv []corev1.EnvVar) []corev1.
 		corev1.EnvVar{Name: "TERDUT_ARCHIVE_AFTER", Value: sweeper.ArchiveAfter},
 	)
 
-	deadman := srv.Spec.Deadman
-	env = append(env,
-		corev1.EnvVar{Name: "TERDUT_DEADMAN_MATCHERS", Value: deadman.Matchers},
-		corev1.EnvVar{Name: "TERDUT_DEADMAN_TIMEOUT", Value: deadman.Timeout},
-		corev1.EnvVar{Name: "TERDUT_DEADMAN_SEVERITY", Value: deadman.Severity},
-	)
-
 	notify := srv.Spec.Notify
 	if notify.NtfyURL != "" {
 		env = append(env,
@@ -230,6 +230,9 @@ func buildEnv(srv *terdutv1alpha1.TerdutServer, dbEnv []corev1.EnvVar) []corev1.
 		// here on" -- which is unconditionally true for anything this
 		// operator creates).
 		corev1.EnvVar{Name: "TERDUT_OPERATOR_MODE", Value: "true"},
+		// The credential this operator calls the API with; the server
+		// creates or re-keys its instance-scoped account from it at start.
+		corev1.EnvVar{Name: "TERDUT_OPERATOR_KEY", ValueFrom: secretEnvSource(operatorKeyRef(srv))},
 	)
 
 	if oidc := srv.Spec.OIDC; oidc.Enabled {
@@ -238,14 +241,10 @@ func buildEnv(srv *terdutv1alpha1.TerdutServer, dbEnv []corev1.EnvVar) []corev1.
 			corev1.EnvVar{Name: "TERDUT_OIDC_CLIENT_ID", Value: oidc.ClientID},
 			corev1.EnvVar{Name: "TERDUT_OIDC_NAME", Value: oidc.Name},
 			corev1.EnvVar{Name: "TERDUT_OIDC_SCOPES", Value: oidc.Scopes},
-			// terdut-server's own defaults for the claims/trust-email knobs
-			// the chart exposes but DESIGN.md's spec doesn't (§4.1's doc
-			// comment on OIDCSpec) -- not configurable here, not an
-			// oversight.
-			corev1.EnvVar{Name: "TERDUT_OIDC_USERNAME_CLAIM", Value: "preferred_username"},
-			corev1.EnvVar{Name: "TERDUT_OIDC_EMAIL_CLAIM", Value: "email"},
-			corev1.EnvVar{Name: "TERDUT_OIDC_GROUPS_CLAIM", Value: "groups"},
-			corev1.EnvVar{Name: "TERDUT_OIDC_TRUST_EMAIL", Value: "false"},
+			corev1.EnvVar{Name: "TERDUT_OIDC_USERNAME_CLAIM", Value: oidc.UsernameClaim},
+			corev1.EnvVar{Name: "TERDUT_OIDC_EMAIL_CLAIM", Value: oidc.EmailClaim},
+			corev1.EnvVar{Name: "TERDUT_OIDC_GROUPS_CLAIM", Value: oidc.GroupsClaim},
+			corev1.EnvVar{Name: "TERDUT_OIDC_TRUST_EMAIL", Value: boolString(oidc.TrustEmail)},
 			corev1.EnvVar{Name: "TERDUT_OIDC_SESSION_MAX_AGE", Value: oidc.SessionMaxAge},
 		)
 		if oidc.ClientSecretRef != nil {